EUVD-2026-65329
GHSA-j64q-jhwc-69jc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SMS delivery is network-based with no complexity; no attacker credentials needed; availability impact is high as device can be rendered unmanageable.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.
AnalysisAI
SMS authentication bypass in Weidmüller IE-SR-2TX-WL-4G industrial 4G routers allows a remote attacker to permanently disable the SMS password requirement by deliberately submitting five or more invalid passwords, after which the device executes all subsequent SMS management commands without any authentication. The root flaw is in the lockout logic: rather than locking out the attacker, the device disables its own password enforcement mechanism, rewarding brute-force attempts with unrestricted SMS command access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The 'Enable Password Authorization' setting must be enabled on the device - if this setting is off, the SMS interface already operates without a password and the lockout bypass provides no additional capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.8 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H reflects a genuinely high-risk profile: network-reachable (via cellular SMS), no complexity, no privileges, and no user interaction required, with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version has been identified at time of analysis; consult CERTVDE advisory VDE-2026-083 at https://www.certvde.com/en/advisories/VDE-2026-083/ for the latest remediation guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Weidmüller IE-SR-2TX-WL-4G routers in production, audit which devices have SMS management enabled, and implement network-level restrictions to limit SMS traffic to known management sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ie Sr 2Tx Wl 4G Eu
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today